Hackers Using Microsoft Teams Messages and Calls to Trick Users and Gain Remote Access to System

Hackers are using Microsoft Teams messages and voice calls to impersonate IT support staff, persuade employees to approve remote access, and move deeper into corporate networks.

Two intrusions investigated by Microsoft show how a seemingly routine help desk conversation can lead to stolen data and access to highly privileged accounts.

The attacks did not exploit a Microsoft Teams vulnerability. Instead, they combined social engineering, legitimate remote-support software, and weak Active Directory Certificate Services configurations.

This Windows service, commonly called AD CS, issues digital certificates that can authenticate users and computers, making insecure settings particularly valuable to attackers.

Microsoft researchers identified malicious JavaScript and Python scripts used for initial access and documented portable runtime variants supporting the intrusions.

Their October 30 investigation described two separate certificate-abuse paths after the attackers secured remote control. Microsoft has not attributed the activity to a named threat actor.

Hackers Using Microsoft Teams Messages and Calls

Both incidents started with attackers posing as help desk personnel through Teams chats and calls. Support-themed display names and organization-themed tenant names made external accounts appear familiar.

The approach mirrors earlier Teams and Quick Assist attacks that used trusted workplace tools to persuade employees to hand over control.

The attackers guided employees into approving an interactive remote-support session, primarily through Quick Assist. That approval marked the critical turning point: the intruder could operate the workstation directly.

Microsoft’s example also showed “External” and “Scam suspected” call indicators, highlighting warnings employees should examine before accepting unexpected support requests.

Once connected, the attacker placed an archive in the Downloads folder, created an update-themed staging directory under the user’s profile, and extracted the files. Portable Python, Bun, or Java runtimes then executed attacker-controlled code.

One renamed executable retained metadata identifying it as Bun, showing why a reassuring filename alone cannot establish whether software is safe.

The staged components checked Windows information, network settings, and running processes before contacting domain infrastructure.

Similar Teams help desk calls have previously supported malware delivery and internal reconnaissance, but Microsoft stressed that investigators must validate each incident’s certificate activity rather than infer it from runtime use alone.

Certificate Abuse, Data Theft, and Defensive Priorities

In the first incident, the attacker exploited an ESC1-vulnerable certificate template. Its settings allowed a low-privileged requester to supply another identity and obtain an authentication certificate for that account.

The initial phishing wave targeted three users, compromised one workstation, and produced certificates for three highly privileged accounts.

About 90 minutes after disruption, another wave targeted 16 users and compromised a second workstation. The attacker obtained certificates for eight additional privileged accounts.

Microsoft Defender blocked more than 1,000 subsequent SMB file-access attempts, but DCSync activity had already begun while containment was taking effect.

One privileged account excluded from automated containment remained usable. The attacker used it to reach a file server and run a renamed Rclone utility, copying files to an external SFTP destination.

The transfer command used 20 concurrent transfers and selected files up to three years old. The second incident followed ESC8 instead. PetitPotam forced a domain controller to authenticate to an attacker-controlled system.

The attacker relayed that NTLM authentication to AD CS Web Enrollment, obtained a domain-controller certificate, and used certificate-based Kerberos authentication to acquire a ticket-granting ticket.

Following Defender alerts, the customer isolated the workstation; no further progression was observed. Defenders should connect Teams interactions with remote-session records, process activity, certificate issuance, and Kerberos events.

Earlier reporting on Teams collaboration feature abuse also explains how collaboration logs help reconstruct these timelines. Employees should verify unexpected support requests through a known internal channel before granting access.

Microsoft recommends restricting external Teams access and unapproved remote tools, reviewing certificate-template permissions, and following its AD CS relay guidance.

Enrollment endpoints should require HTTPS and Extended Protection for Authentication. Responders must revoke unauthorized certificates and separately review Kerberos tickets: resetting passwords alone does not remove certificate-backed access.

Containment exclusions also need immediate review, because leaving one privileged identity available can preserve the attacker’s route even when other accounts are blocked.

Indicators of compromise (IoCs):-

Indicator	Type	Source-described role
85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17	SHA-256	Initial-access JavaScript
f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001	SHA-256	Initial-access Python script
06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7	SHA-256	Initial-access Python script

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.